Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
SonarQube may execute harmful code through LZ4 compression
published 5 days ago
Summary
The SonarQube package includes a Java library that compresses data with LZ4. An attacker could craft specially formed compressed data that, when processed, could cause the SonarQube server to run unintended code. Update SonarQube to the latest version or apply the vendor's recommended patch to fix the issue.
What to do
- Update cleanstart sonarqube to version 26.8.0.126808-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | sonarqube |
< 26.8.0.126808-r3 Fix: upgrade to 26.8.0.126808-r3
|
Original advisory text
yawkat LZ4 Java provides LZ4 compression for Java
Security vulnerability affects the sonarqube package. yawkat LZ4 Java provides LZ4 compression for Java.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-HG75329 · OSV
Track software like this
Free during beta